test: cover optional security alternatives

[kriptoburak]

Summary

• Adds OpenAPI 3.0 and 3.1 YAML unmarshal coverage for optional security alternatives.
• Verifies empty security requirements can sit alongside API key security requirements.

Validation

• go test ./openapi3 ./openapi31 -run OptionalSecurityAlternative

[llamapreview]

AI Code Review by LlamaPReview

🎯 TL;DR & Recommendation

Recommendation: Approve with suggestions

This PR adds YAML unmarshal test coverage for optional security alternatives in OpenAPI 3.0 and 3.1. While the tests function correctly, two improvements would enhance clarity and robustness.

🌟 Strengths

• Effective coverage for a scenario previously untested.
• Consistent with existing test patterns in the codebase.

💡 Suggestions (P2)

• openapi3/entities_extra_test.go: The test function name TestSpec_MarshalYAML_OptionalSecurityAlternative misleadingly suggests marshalling, but it tests unmarshalling. Renaming would reduce confusion for future maintainers.
• openapi3/entities_extra_test.go: The test only asserts no error during unmarshalling. Adding explicit assertions on the parsed security fields would catch potential bugs in handling empty security alternatives.

---

💡 Have feedback? We'd love to hear it in our GitHub Discussions.
✨ This review was generated by LlamaPReview Advanced, which is free for all open-source projects. Learn more.

[llamapreview]

P2 | Confidence: High

The function name starts with TestSpec_MarshalYAML_, which implies the test exercises marshalling (e.g., MarshalYAML). However, the test body calls UnmarshalYAML, not MarshalYAML. This is misleading for developers reading or maintaining the test. While it matches the naming pattern of existing tests in this file (which have the same inconsistency), it perpetuates technical debt that reduces clarity.

Suggested change

	func TestSpec_MarshalYAML_OptionalSecurityAlternative(t *testing.T) {
	var s openapi3.Spec
	spec := `openapi: 3.0.3
	info:
	func TestSpec_UnmarshalYAML_OptionalSecurityAlternative(t *testing.T) {
	var s openapi3.Spec
	spec := `openapi: 3.0.3
	info:
	title: Optional Security API

[llamapreview]

P2 | Confidence: Medium

Speculative: The test only asserts that UnmarshalYAML returns no error. It does not validate the content of the parsed Security field. For example, it does not check that s.Security has exactly two elements, the first being an empty map (representing an optional alternative with no security) and the second containing "apiKeyAuth". If the library mishandles empty security objects (e.g., ignores them, stores nil, or merges them), this test would pass despite producing incorrect results. Adding explicit assertions would make the test robust and reveal potential unmarshalling bugs.

Code Suggestion:

require.NoError(t, s.UnmarshalYAML([]byte(spec)))
	require.Len(t, s.Security, 2)
	require.Empty(t, s.Security[0])
	require.Contains(t, s.Security[1], "apiKeyAuth")
}